Adding asset criticality and entity store permissions to built in roles

Author: opauloh

x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStore.java

@@ -71,6 +71,11 @@ public class ReservedRolesStore implements BiConsumer<Set<String>, ActionListene
     public static final String LISTS_ITEMS_INDEX = ".items-*";
     public static final String LISTS_ITEMS_INDEX_REINDEXED_V8 = ".reindexed-v8-items-*";
 
+    /** "Security Solutions" Entity Store and Asset Criticality indices for Asset Inventory and Entity Analytics */
+    public static final String ENTITY_STORE_V1_LATEST_INDEX = ".entities.v1.latest.security*";
+    public static final String ASSET_CRITICALITY_INDEX = ".asset-criticality.asset-criticality-*";
+
+
     /** Index pattern for Universal Profiling */
     public static final String UNIVERSAL_PROFILING_ALIASES = "profiling-*";
     public static final String UNIVERSAL_PROFILING_BACKING_INDICES = ".profiling-*";
@@ -780,7 +785,9 @@ private static RoleDescriptor buildViewerRoleDescriptor() {
                         ReservedRolesStore.LISTS_ITEMS_INDEX,
                         ReservedRolesStore.ALERTS_LEGACY_INDEX_REINDEXED_V8,
                         ReservedRolesStore.LISTS_INDEX_REINDEXED_V8,
-                        ReservedRolesStore.LISTS_ITEMS_INDEX_REINDEXED_V8
+                        ReservedRolesStore.LISTS_ITEMS_INDEX_REINDEXED_V8,
+                        ReservedRolesStore.ENTITY_STORE_V1_LATEST_INDEX,
+                        ReservedRolesStore.ASSET_CRITICALITY_INDEX
                     )
                     .privileges("read", "view_index_metadata")
                     .build(),
@@ -842,10 +849,16 @@ private static RoleDescriptor buildEditorRoleDescriptor() {
                         ReservedRolesStore.LISTS_ITEMS_INDEX,
                         ReservedRolesStore.ALERTS_LEGACY_INDEX_REINDEXED_V8,
                         ReservedRolesStore.LISTS_INDEX_REINDEXED_V8,
-                        ReservedRolesStore.LISTS_ITEMS_INDEX_REINDEXED_V8
+                        ReservedRolesStore.LISTS_ITEMS_INDEX_REINDEXED_V8,
+                        ReservedRolesStore.ASSET_CRITICALITY_INDEX
                     )
                     .privileges("read", "view_index_metadata", "write", "maintenance")
                     .build(),
+                // Security - Entity Store is view only
+                RoleDescriptor.IndicesPrivileges.builder()
+                    .indices(ReservedRolesStore.ENTITY_STORE_V1_LATEST_INDEX)
+                    .privileges("read", "view_index_metadata")
+                    .build(),
                 // Alerts-as-data
                 RoleDescriptor.IndicesPrivileges.builder()
                     .indices(

x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/security/authz/store/ReservedRolesStoreTests.java

@@ -3669,6 +3669,9 @@ public void testPredefinedViewerRole() {
         assertOnlyReadAllowed(role, ".profiling-" + randomIntBetween(0, 5));
         assertOnlyReadAllowed(role, randomAlphaOfLength(5));
 
+        assertOnlyReadAllowed(role, ".entities.v1.latest.security" + randomIntBetween(0, 5));
+        assertOnlyReadAllowed(role, ".asset-criticality.asset-criticality-" + randomIntBetween(0, 5));
+
         assertOnlyReadAllowed(role, ".slo-observability." + randomIntBetween(0, 5));
         assertViewIndexMetadata(role, ".slo-observability." + randomIntBetween(0, 5));
 
@@ -3739,6 +3742,7 @@ public void testPredefinedEditorRole() {
         assertOnlyReadAllowed(role, "endgame-" + randomIntBetween(0, 5));
         assertOnlyReadAllowed(role, "profiling-" + randomIntBetween(0, 5));
         assertOnlyReadAllowed(role, ".profiling-" + randomIntBetween(0, 5));
+        assertOnlyReadAllowed(role, ".entities.v1.latest.security*" + randomIntBetween(0, 5));
         assertOnlyReadAllowed(role, randomAlphaOfLength(5));
 
         assertReadWriteDocsAndMaintenanceButNotDeleteIndexAllowed(role, ".siem-signals-" + randomIntBetween(0, 5));
@@ -3749,6 +3753,7 @@ public void testPredefinedEditorRole() {
         assertReadWriteDocsAndMaintenanceButNotDeleteIndexAllowed(role, ".internal.alerts-" + randomIntBetween(0, 5));
         assertReadWriteDocsAndMaintenanceButNotDeleteIndexAllowed(role, ".preview.alerts-" + randomIntBetween(0, 5));
         assertReadWriteDocsAndMaintenanceButNotDeleteIndexAllowed(role, ".internal.preview.alerts-" + randomIntBetween(0, 5));
+        assertReadWriteDocsAndMaintenanceButNotDeleteIndexAllowed(role, ".asset-criticality.asset-criticality-" + randomIntBetween(0, 5));
 
         assertViewIndexMetadata(role, ".slo-observability." + randomIntBetween(0, 5));
         assertReadWriteAndManage(role, ".slo-observability." + randomIntBetween(0, 5));